S.NSA - Cardano pricing, other statements
Wednesday, 30 October, Year 5 d.Tr. | Author: Mircea Popescu
People have been of course asking since the day the Cardano was announced, almost three weeks ago. We, by which I mean mostly Mr. Datskovskiy, have been hard at work in the interval to try and get an idea of exactly how much will it cost (or, perhaps better put, how much will it not cost!). Here's a spurious pic of the prototyping bed used :
So now on to the good bits. There are a few statements we can make about the future producti :
- The unit size will be approximately 4 x 3 x 1 inches, give or take an inch.
- The unit will be encased in clear acrylic, held together by four common Phillips screws. This will allow easy enough access to the user serviceable parts inside (battery, socketed eeproms etc).
- The unit will have the NSA logo laser-etched into the surface, cause we got a laser and we ain't afraid to use it.
- The per unit price we are currently contemplating is 0.35 BTC.
- Customers buying three units get them for 1 BTC total. They also get a pair (M + XL) of NSA t-shirtsii as a bonus. All prices include regular mail shipping.
Here's the NSA t-shirt, graciously modelled by Mr. Nubbins (could you tell ?) :
Doesn't it look cool ? Don't you want one yourself ? Hm ? HM ?
———
Category: S.NSA
Wednesday, 30 October 2013
Perhaps some kind of tamper evident seal is in order to provide visual verification that the EEPROM hasn't been removed and tampered with by, say an evil maid. Just thinking aloud, that's all...
Wednesday, 30 October 2013
Seals, especially of the mass-produced varieties I know of, are a sad joke.
A serious tamper-detection mechanism would multiply the cost of the device several-fold.
A simpler, non-automatic countermeasure: ROM hash inscribed on the chip itself. Said ROM being per-unit unique. A true paranoiac can yank and rehash whenever he wishes. Best to stow a copy of the label somewhere far away...
Wednesday, 30 October 2013
@Mike the goat In principle a tamper evident seal is useful if it works. If it fails to work while it's being relied on to work it is not merely useless, it is less than useless.
You can have two types of tamper evident seals : the ones that are evident to the unit and the ones that are evident to the operator. As far as the first set goes, we had in fact considered all sorts of sensor arrangements, all the way up to barometric. The problem is that no such scheme is in fact indefeasible, and therefore an attacker will simply attack in the manner that guarantees success. In short, trying to implement something like a tamper evident seal that's evident to the unit is almosty guaranteed to deliver a unit that's less useful than if it were bereft of the seal.
As far as the tamper evident seals that are evident to the operator go, one could of course put a little stamp in wax or lipstick or chewing gum or anything else on one of the screws or on the side or w/e. By its very nature this sort of sealing is nonstandardised, which significantly increases its usefulness, and correspondingly reduces the chances of successful attack.
So : sealing of the unit best implemented by user.
Wednesday, 30 October 2013
Yes, I can see the benefit of not having a "standard" sealing method. Yes barometric would be very interesting and relatively cheap to implement. It could even not necessarily be electronic (think along the lines of the error flag mechanism in an aircraft gyro that falls when there is no suction). That said it would be easy enough to have the electronics check the baro of the container interior on initialization and to flag an error if it ever changes.
Wednesday, 30 October 2013
.... or we can fill the thing with an inert atmosphere, pack it full of something pyrophoric and give an attacker a real surprise if they open it ;-)
(yes I know the most likely outcome is the seal being accidentally breached by the owner resulting in horrible, horrible burns. But y'know, gotta keep your coins safe!)
Wednesday, 30 October 2013
Mike the goat,
Barometric sensors are cheap, true, but consider the cost of turning the device into a usefully-sealed ampule.
The enemy, if he feels like it, will determine the internal pressure of the ampule ultrasonically, and then proceed to crack the nut inside a chamber pressurized to match. Without breaking a sweat.
MP's point applies: the best seal is the one whose very existence is known only to the owner. A speck of dust slipped under a screw head ends up being of far more use than a whole gaggle of electronic sensors.
Wednesday, 30 October 2013
Tradition shows that womanly lures make the best tamper evident seals (which is why the lady knows). I've used to great effect flavoured transparent lip gloss (which you can't see or smell but you can fucking taste in concentrations of 1 ppm and less) and those glitzy pixie dust shits, whatever they call them. They'll only shine at the right angle, but then shine they will.
As to the other point : that's exactly the problem, the more "fine" you make the sensors in a doomed attempt to defeat the attacker afore the fact, the more innocent users will get hurt. No attackers will ever be harmed by this experiment. Which is why we're the NSA not the TSA.
Wednesday, 30 October 2013
Haha fair point Mircea!
Stanislav: yes, I see your point.
Thursday, 31 October 2013
Just seal all nonserviceable parts into epoxy?
Thursday, 31 October 2013
Where's that pic with the hotglue miners...
Thursday, 31 October 2013
Holy shit I thought the user was supposed to open it, to replace the battery and w/e
Friday, 1 November 2013
Anon: I am sure you could either a) hack a qi receiver into the box and use wireless charging or b) put a small PV panel and a charging circuit so that it can charge via visible light. Not sure how Stanislav and Mircea designed it but I assume that the keying material is stored on a flash or eeprom device and the battery is only used when zapping/generating a fresh keypair. I would be terrified if my key was in volatile memory lest the battery die prematurely and without warning.
Now, I know that this is well outside your design brief but I will mention it anyway. An import/export function would be an essential feature for many users - even if such a function degrades the security of the product. Yes I am aware of all the issues this could create but I still think it is necessary for some people. Now, I know that MP's response will be "they can use another product, we are not doing it" but nevertheless I think that this will become an often requested feature. It raises some huge issues - not denying that - and would be an unacceptable risk to someone that has no need for it (even if such a feature could be disabled at initialization time). But perhaps if the caradano is a success and there is demand for it you guys can take the time to make such a device that attempts to fill this need in the market in the least insecure way possible (yes, the imported key may have already been leaked; the imported key may have been generated on a machine with a broken RNG; etc. and yes the export function could potentially be used against the user, etc.)
I guess - until then there are smart cards, however some cards are worse than using no smart card at all (case in point some of the old gemplus cards had a broken entropy source, more recently a Taiwanese vendor had similar problems.. Oh and most s/cs are 1024 or 2048 RSA only, which rules my 4096 key out immediately).
In the mean time compartmentalization and judicious use of subkeys are the best choice.
Friday, 1 November 2013
The eeprom is socketed, so the users can examine them or replace them.
The import/export was brought up before.
At any rate, the Cardano is by no means intended to be the last product NSA ever makes. It's just the first.
Friday, 1 November 2013
Mike the goat,
Even if you disregard the (abundant) design flaws of the existing smartcards, there remain two basic problems: 1) The host PC is aware of the fact of a purpose-built piece of cryptographic hardware being plugged in. That is to say, a big fat bull's eye for a compromised OS to shoot into. 2) The owner's ability to verify that a smartcard "does what it says on the box" - unless he has an electron microscope, ion beam workstation, and abundant spare time - is effectively nil.
#2 applies to any and all systems where an RNG is contained on chip. That is a dead end from the very beginning. A proper TRNG must consist of discrete, commonly-available components, whose function can be verified with: sharp eyes, and basic electrical test instruments - oscilloscope, logic analyzer, software of your own design connected to either.
Friday, 1 November 2013
Mike the goat,
The battery is used for *all* operations involving the private key. In fact, the RSA key ROM receives power only when the device is running from the battery. This eliminates a whole host of potential boojums.
At any rate, if you want to seal your unit in a glass ampule, you're welcome to do so yourself. At the target price point, such luxuries are out of the question.
Saturday, 2 November 2013
Stanislav: re "boojums" - makes sense that you'd want to avoid, say power analysis being used on the device amongst other things if you were to rely on USB bus power.
re RNG - yes, we've had this conversation before on schneier.com. You know my feelings about "black box" RNGs like Intel RDRAND where verification (at least for the average electronics shop engineer) is impossible. Good choice.
re sealing the device - I would assume those buying the device will have their own ideas about how to secure it. Obviously the best thing is to ensure that the damn thing is never allowed to get into a situation where it could potentially fall into the hands of an adversary (without first being cleared).
re the host PC being aware its a security device - no doubt if the Cardano becomes popular an evil OS could look for a mass storage device that conforms to your spec (i.e. is FAT16, reports whatever size you decided upon, etc). I guess if your OS has been subverted then it is game over on many different fronts.
.. Which brings us to the PC architecture and how much it stinks. Got a free afternoon?!!! ;-)